Integrated propeller and engine controller

ABSTRACT

An electronic controller for an engine and a propeller, a control system and related methods are described herein. The controller comprises a first channel and a second channel independent from and redundant to the first channel. Each channel having a control processor configured to receive first engine and propeller parameters and to output, based on the first engine and propeller parameters, at least one engine control command comprising instructions for controlling an operation of the engine and at least one propeller control command comprising instructions for controlling an operation of the propeller. Each channel also comprises a protection processor configured to receive second engine and propeller parameters and to output based on the second engine and propeller parameters, at least one engine protection command comprising instructions for protecting the engine from hazardous conditions and at least one propeller protection command comprising instructions for protecting the propeller from hazardous conditions.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application claims priority under 35 U.S.C. 119(e) ofProvisional Patent Application bearing Ser. No. 62/770,896 filed on Nov.23, 2018, and Provisional Patent Application bearing Ser. No. 62/770,912filed on Nov. 23, 2018, the contents of which are hereby incorporated byreference.

TECHNICAL FIELD

The present disclosure relates generally to control for an engine and apropeller coupled thereto.

BACKGROUND OF THE ART

For propeller driven aircraft, the powerplant consists of a gas turbineengine and a propeller. Typically, the engine and propeller each havetheir own control system. For instance, the engine is controlled by anengine control system and the propeller is controlled by a separatepropeller control system. However, there may be some inefficiencies withthis approach.

There is therefore a need for improvements.

SUMMARY

In one aspect, there is provided an electronic controller for an engineand a propeller coupled to the engine. The controller comprises a firstcommunication channel and a second communication channel independentfrom and redundant to the first communication channel. Eachcommunication channel has a control processor and a protection processorcommunicating thereover. The control processor controlling the engineand the propeller in a normal mode of operation thereof and theprotection processor controlling the engine and the propeller to preventagainst a hazardous mode of operation thereof. The control processor isconfigured to receive a first set of engine and propeller parameters andto output, based on the first set of engine and propeller parameters, atleast one engine control command and at least one propeller controlcommand. The at least one engine control command comprises instructionsfor controlling the engine in the normal mode of operation and the atleast one propeller control command comprises instructions forcontrolling the propeller in the normal mode of operation. Theprotection processor configured to receive a second set of engine andpropeller parameters and to output, based on the second set of engineand propeller parameters, at least one engine protection command and atleast one propeller protection command. The at least one engineprotection command comprises instructions overriding the at least oneengine control command to prevent hazardous operation of the engine andthe at least one propeller protection command comprises instructionsoverriding the at least one propeller control command to preventhazardous operation of the propeller.

In one aspect there is provided a method for controlling an engine and apropeller coupled to the engine. The method comprises receiving a firstset of engine and propeller parameters at a first control processorprovided in a first communication channel and at a second controlprocessor provided in a second communication channel independent fromand redundant to the first communication channel, receiving a second setof engine and propeller parameters at a first protection processorprovided in the first communication channel and at a second protectionprocessor provided in the second communication channel, generating, byat least one of the first control processor and the second controlprocessor and based on the first engine and propeller parameters, atleast one engine control command and at least one propeller controlcommand, the at least one engine control command comprising instructionsfor controlling the engine in the normal mode of operation and the atleast one propeller control command comprising instructions forcontrolling the propeller in the normal mode of operation, generating,by at least one of the first protection processor and the secondprotection processor and based on the second engine and propellerparameters, at least one engine protection command and at least onepropeller protection command, the at least one engine protection commandcomprising instructions for overriding the at least one engine controlcommand to prevent hazardous operation of the engine and the at leastone propeller protection command comprising instructions for overridingthe at least one propeller control command to prevent hazardousoperation of the propeller, outputting, by at least one of the firstcontrol processor and the second control processor, the at least oneengine control command and the at least one propeller control command,and outputting, by at least one of the first protection processor andthe second protection processor, the at least one engine protectioncommand and the at least one propeller protection command.

DESCRIPTION OF THE DRAWINGS

Reference is now made to the accompanying figures in which:

FIG. 1 is a schematic cross-sectional view of an example gas turbineengine and propeller;

FIG. 2 is a block diagram of an integrated propeller and enginecontroller for controlling the engine and the propeller of FIG. 1, inaccordance with an embodiment;

FIG. 3 is a block diagram of the controller of FIG. 2 with propeller andengine control and protection modules, in accordance with a specific andnon-limiting example of implementation;

FIG. 4 is a block diagram of the controller of FIG. 3 illustrating dualcoil sensors;

FIG. 5 is a block diagram of the controller of FIG. 3 illustratingeffectors having dual actuators;

FIG. 6 is a flowchart illustrating an example method for integratedcontrol of an engine and propeller; and

FIG. 7 is a block diagram of an example processor for implementing thecontroller of FIG. 2, in accordance with an embodiment.

It will be noted that throughout the appended drawings, like featuresare identified by like reference numerals.

DETAILED DESCRIPTION

FIG. 1 illustrates a turbopropeller powerplant 10 for an aircraft of atype preferably provided for use in subsonic flight, generallycomprising an engine 100 and a propeller 120. The turbopropellerpowerplant 10 can be controlled using the controllers and systemsdescribed herein. The turbopropeller powerplant 10 generally comprisesin serial flow communication the propeller 120 attached to a shaft 108and through which ambient air is propelled, a compressor section 114 forpressurizing the air, a combustor 116 in which the compressed air ismixed with fuel and ignited for generating an annular stream of hotcombustion gases, and a turbine section 106 for extracting energy fromthe combustion gases. The propeller 120 converts rotary motion from ashaft of the engine 110 to provide propulsive force for the aircraft,also known as thrust. The propeller 120 comprises one or more propellerblades 122. A blade angle of the propeller blades 122 may be adjusted.The blade angle may be referred to as a beta angle, an angle of attackor a blade pitch. The turbopropeller powerplant 10 may be implemented tocomprise a single or multi-spool gas turbine engine with a free turbineor boosted architecture, where the turbine section 106 is connected tothe propeller 120 typically through a reduction gearbox (RGB).

With reference to FIG. 2, there is shown an integrated propeller andengine controller 200 for engine control and protection and propellercontrol and protection. The controller 200 is illustrated as part of acontrol system 300 for controlling the engine 100 and the propeller 120mechanically coupled to the engine 100. It should be understood that,while the controller 200 and the system 300 are described herein withreference to the engine 100 and the propeller 120 of FIG. 1, this is forexample purposes. The controller 200 and/or the system 300 may be usedwith any other suitable engine and/or other suitable propeller.

The controller 200 provides both engine and propeller control andprotection in a single electronic control unit. The controller 200comprises a first communication channel (hereinafter “channel A”) and asecond communication channel (hereinafter “channel B”). In other words,the controller 200 is a dual channel controller having channels A and B.The two channels A and B are fully redundant as each channel A and Bimplements the same functionality. The two channels A and B areindependent from each other, as the operation of each channel does notdepend on the operation of the other channel.

Each channel (e.g., channel A) comprises two processors (e.g.,processors 212, 214). One processor (e.g., processor 212) is dedicatedto engine and propeller control functions and the other processor (e.g.,processor 214) is dedicated to engine and propeller protectionfunctions. The engine and propeller control functions are forcontrolling the operation of the engine 100 and propeller 120. Theengine and propeller protection functions are for protecting the engine100 and the propeller 120 from (i.e. providing protection against theoccurrence of) hazardous condition(s). As used herein, the term“hazardous condition” refers to a condition or event that is hazardous,or harmful, to operation of the engine 100 or propeller 120. The engineand propeller protection functions therefore prevent hazardous operationof the engine 100 and of the propeller 120. The control functions arethus for controlling operation of the engine and propeller in a normalmode of operation and the protection functions are for protecting theengine and propeller from a hazardous mode of operation that would occurif the control functions of the normal mode of operation are notoverridden.

As illustrated, channel A comprises a first control processor 212 and afirst protection processor 214 and channel B comprises a second controlprocessor 222 and second protection processor 224. The controlprocessors 212, 222 are independent from each other and one of theprocessors is redundant as both control processors 212, 222 implementthe same functionality. Similarly, the protection processors 214, 224are independent from each other and one of the processors is redundantas both protection processors 214, 224 implement the same functionality.The control processors 212, 222 are configured to provide engine andpropeller control functions and the protection processors 214, 224 areconfigured to provide engine and propeller protection functions.Functions that are deemed not to be control or protection functions(e.g., parameter exceedance monitoring) may be allocated to either thecontrol processors 212, 222 or the protection processors 214, 224.

In particular, each control processor 212, 222 is configured to receiveengine and propeller parameters and to output, based on the engine andpropeller parameters, at least one engine control signal (also referredto herein as an “engine control command”) comprising instructions forcontrolling the engine 100 in the normal mode of operation and at leastone propeller control signal (also referred to herein as an “propellercontrol command”) comprising instructions for controlling the propeller120 in the normal mode of operation. Similarly, each protectionprocessor 214, 224 is configured to receive engine and propellerparameters and to output based on the engine and propeller parameters,at least one engine protection signal (also referred to herein as an“engine protection command”) comprising instructions for protecting theengine 100 by overriding the at least one engine control command toprevent hazardous operation of the engine 100 and at least one propellerprotection signal (also referred to herein as an “propeller protectioncommand”) comprising instruction for protecting the propeller 120 byoverriding the at least one propeller control command to preventhazardous operation of the propeller 120. The engine and propellerparameters received at each processor 212, 214, 222, 224 may varydepending on practical implementations. The engine and propellerparameters received at a given processor 212, 214, 222, 224 may bereferred to as a set of engine and propeller parameters. For example,the control processors 212, 222 may receive a first set of engine andpropeller parameters and the protection processors 214, 224 may receivea second set of engine and propeller parameters. The engine andpropeller parameters received at each processor 212, 214, 222, 224 maycomprise the same parameters, different parameters, independentparameters and/or redundant parameters. Various examples of the receivedengine and propeller parameters are described further elsewhere in thisdocument.

The engine and propeller parameters are related to the operation andcontrol of the engine 100 and the propeller 120. In accordance with anembodiment, the engine parameters comprise at least one engine operationparameter and at least one engine control parameter; and the propellerparameters comprise at least one propeller operation parameter and atleast one propeller control parameter. The engine operation parametersare indicative of at least one operating condition of the engine 100 andinclude, but are not limited to, one or more of fuel flow (WF) to theengine 100, a position of at least one inlet guide vane (IGV), aposition of at least one core variable guide vane (VGV), engine bleed, aposition of at least one bleed off valve (BOV), rotational speed of theengine 100, shaft power, shaft torque, shaft speed, compressor pressure,turbine temperature and/or any other suitable engine operationparameter. The propeller operating parameters are indicative of at leastone operating condition of the propeller 120 and include, but are notlimited to, one or more of a position of the blade angle of thepropeller 120, a position of a beta ring of the propeller 120, arotational speed of the propeller 120 and/or any other suitablepropeller operation parameter. The engine control parameters relate tothe control of the engine 100 and include, but are not limited to, oneor more of a target engine thrust, a target engine output power and/orany other suitable engine control parameter. The propeller controlparameters are instructions for controlling the propeller 120 andinclude, but are not limited to, one or more of a target propellerrotational speed, a target blade pitch angle and/or any other suitablepropeller control parameter.

The engine and propeller parameters may be monitored by one or moresensors 332, 334 communicatively coupled to the controller 200. Forexample, the sensor(s) 332 may be configured to measure engine operationparameters and the sensor(s) 334 may be configured to measure propelleroperation parameters. In one embodiment, the sensor(s) 332 may becoupled to the engine 100 and the sensor(s) 334 may be coupled to thepropeller, as illustrated in FIG. 2. In another embodiment, thesensor(s) 332 may be integrated with the engine 100 and the sensor(s)334 may be integrated with the propeller 120. The measurements of theengine parameters and propeller parameters may be continuously received(e.g., in real time) and/or may be received in accordance with anysuitable regular or irregular time interval. Additionally oralternatively, the engine and propeller parameters may be provided byone or more aircraft or/and engine computers.

In accordance with an embodiment, the engine and propeller controlparameters are indicative of one or more commands from one or more pilotlevers 310. The pilot lever(s) 310 may include, but is not limited to, athrust lever to set the target engine thrust, a power lever used to setthe target engine output power, a condition lever used to set the targetpropeller rotational speed, a condition lever used to set the targetblade pitch angle, and/or any other suitable pilot lever. The engine andpropeller control parameters may be provided directly from the pilotlever(s) 310 (e.g., by one or more sensors) or provided by an engineand/or aircraft computer communicatively coupled to the pilot lever(s)310. The aircraft computer may determine one or more engine andpropeller control parameters from measurements obtained from one or moresensors of the pilot lever(s) 310.

The engine and propeller parameters can be provided to the controller200 by way of input signals from one or more sensors 332, 334, one ormore pilot levers 310 and/or one or more aircraft and/or enginecomputers. A given engine or propeller parameter may be referred to asan operating parameter of the assembly 10. Accordingly, a given sensors332, 334 can measure a given operating parameter of the assembly 10.Depending on practical implementations, input signals to each of theprocessors 212, 222, 214, 224 may comprise the same signals, differentsignals, independent signals and/or redundant signals. Various examplesof the input signals to each of the processor 212, 222, 214, 224 isdescribed elsewhere in this document.

Each control processor 212, 222 is configured to generate controlsignals for controlling the engine 100 and the propeller 120 based onthe received engine and propeller parameters. The control signalscomprise instructions for controlling the operation of the engine 100(i.e., for controlling at least one operating condition of the engine100) and the operation of the propeller 120 (i.e., for controlling atleast one operating condition of the propeller 120). In accordance withan embodiment, the control signals comprise at least one engine controlsignal for controlling the operation of the engine 100 and at least onepropeller control signal for controlling the operation of the propeller120. The engine control signals may comprise instructions to adjust oneor more of the engine operation parameters to control an operatingcondition of the engine 100. The propeller control signals may compriseinstructions to adjust one or more propeller operation parameters tocontrol an operating condition of the propeller 120.

Each control processor 212, 222 may be configured to generate at leastone engine control signal for controlling the engine based on one ormore engine parameters and/or based on one or more propeller parameters.Similarly, each control processor 212, 222 may be configured to generateat least one propeller control signal for controlling the propellerbased on one or more engine parameters and/or based on one or morepropeller parameters. Each control processor 212, 222 is configured tooutput the control signals. By way of a simplified example, the enginecontrol signal may be a fuel flow command to adjust the fuel flow to theengine 100 and the propeller control signal may be a beta angle commandto adjust the beta angle of the propeller 120.

In accordance with an embodiment, each control processor 212, 222 isconfigured to output the engine and propeller control signals to one ormore actuators 322, 324 for controlling operation of the engine 100 andthe propeller 120. The actuator(s) 322 may indeed adjust the one or moreengine parameters (e.g., adjust physical components of the engine 100)according to the engine control signals while the actuator(s) 324 mayadjust the one or more propeller parameters (e.g., adjust physicalcomponents of the propeller 120) according to the propeller controlsignals. For example, the actuator(s) 322 may actuate (e.g. turn “ON” or“OFF”) a fuel pump to adjust the fuel flow to the engine 100. By way ofanother example, the actuator(s) 324 may adjust a position of apropeller pitch change actuator to adjust the beta angle. It should beunderstood that, while the actuator(s) 322 are illustrated as separatefrom the engine 100 (for clarity purposes), the actuator(s) 322 may beintegrated with the engine 100. Similarly, while the actuator(s) 324 areillustrated as separate from the propeller 120, the actuator(s) 324 maybe integrated with the propeller 120.

Each protection processor 214, 224 is configured to generate controlsignals (referred to herein as “protection signals”) for protecting theengine 100 and the propeller 120 based on the received engine andpropeller parameters. In accordance with an embodiment, the protectionsignals comprise at least one engine protection signal comprisinginstructions for protecting the engine 100 from one or more hazardousconditions and at least one propeller protection signal comprisinginstructions for protecting the propeller 120 from one or more hazardousconditions. The hazardous condition(s) of the propeller 120 may be thesame as or may be different from the hazardous condition(s) of theengine 100. Each protection processor 214, 224 may be configured togenerate the at least one engine protection signal based on one or moreengine parameters and/or based on one or more propeller parameters.Similarly, each protection processor 214, 224 may be configured togenerate the at least one propeller protection signal based on one ormore engine parameters and/or based on one or more propeller parameters.In one embodiment the engine protection signal(s) may compriseinstructions to adjust one or more of the engine operation parameters tocontrol an operating condition of the engine 100 in order to protect theengine 100 from a hazardous condition. The propeller protectionsignal(s) may comprise instructions to adjust one or more propelleroperation parameters to control an operating condition of the propeller120 in order to protect the propeller 120 from a hazardous condition.Each protection processor 214, 224 is configured to output theprotection signal(s), with the engine protection signal(s) being outputto the actuator(s) 322 and the propeller protection signal(s) beingoutput to the actuator(s) 324.

In some embodiments, the configuration of the controller 200 and/or thecontrol system 300 allows for one or more of: the elimination of heavyhydro mechanical devices dedicated to protection functions (e.g., engineoverspeed, propeller overspeed, below minimum in-flight propeller bladeangle, etc.); the elimination of a second electronic controller separatefrom controller 200; and the simplification of the electrical harnessand interface, while maintaining the independence of the control andprotection functionalities. In accordance with an embodiment, there is asingle controller 200 for both the engine 100 and the propeller 120, andthe electrical signals are going to this single controller 200 ratherthan to separate controllers. This can allow for simplification ofharness design as there may be fewer entities involved in harness designand routing. This may also allow for a weight reduction because theelectrical signals are only routed to a single controller. Thecontroller 200 and/or the control system 300 differs from conventionalsystems having separate engine and propeller control systems, where eachof the engine and propeller control systems typically have a singleprocessor and a hydro-mechanical backup. It should be appreciated thatthe hydro-mechanical backup is typically heavy and may add anundesirable complexity and weight to the control system. The controller200 and/or the control system 300 also differs from conventional systemswhere segregation of the engine and propeller control systems exists andeach of the engine and propeller control systems have a dual channelelectronic controller with a processor on each channel. Segregation ofthe control systems may exist because different engine and propellersuppliers develop their own proprietary controller with proprietarysoftware. Segregation of the control systems may also exist to provideredundancy to ensure that no single electronic failure can lead to ahazardous event. It should be appreciated that the segregation of thecontrol systems may add an undesirable complexity to the control of thepowerplant. The controller 200 and/or the control system 300 may alsodiffer from conventional additional independent safety systems dedicatedto safety functions used to protect against hazardous events such aspropeller overspeed. Such additional safety systems are typically eitherhydro-mechanical in nature or are provided in a separate electroniccontroller to the ones allocated to controlling the engine and thepropeller.

With additional reference to FIG. 3, there is shown a specific andnon-limiting example of the controller 200. In this example, eachcontrol processor 212, 222 comprises a propeller control module 232 andan engine control module 234. The propeller control module 232 may usepropeller control laws to control the propeller 120 and the enginecontrol module 232 may use engine control laws to control the engine100. The control laws may be implemented as any suitable function thatdetermines one or more output parameters based on one or more inputparameters. The engine control laws may be used to determine the controlsignals for controlling the engine based on the one or more engineand/or propeller parameters. Similarly, the propeller control laws areused to determine the control signals for controlling the propellerbased on the one or more engine and/or propeller parameters.

Each control processors 212, 222 may be configured for one or more of:governing a rotational speed of the engine 100, governing an outputpower of the engine 100, limiting a torque of the engine 100, limitingthe rotational speed of the engine 100, governing a beta angle of thepropeller 120, governing the rotational speed of the propeller,adjusting the position of a bleed off valve, and adjusting the angle ofan inlet guide vane. The aforementioned limiting or governing relatingto the engine 100 may be performed by the engine control module 234 andthe aforementioned limiting or governing relating to the propeller 120may be performed by the propeller control module 232. In particular, theengine control module 234 may be configured to determine the at leastone engine control signal comprising instructions for one or more of:governing the rotational speed of the engine 100, governing the outputpower of the engine 100, limiting the torque of the engine 100, andlimiting the rotational speed of the engine 100. The propeller controlmodule 232 may be configured to determine the at least one propellercontrol signal comprising instructions for one or more of: governing abeta angle of the propeller, and governing a rotational speed of thepropeller.

In the illustrated example, each protection processor 214, 224 comprisesa propeller protection module 236 and an engine protection module 238.The propeller protection module 236 may use propeller protectionfunctions to protect the propeller 120 and the engine protection module238 may use engine protection functions to protect the engine 100. Theengine protection functions may be used to determine the engineprotection signals for protecting the engine 100 based on one or moreengine and/or propeller parameters. Similarly, the propeller protectionfunctions may be used to determine the propeller protections signals forprotecting the propeller based on one or more engine and/or propellerparameters.

Each protection processor 214, 224 is configured to protect the engine100 and the propeller 120 against hazardous conditions. For instance,each protection processor 214, 224 may be configured for one or more of:protecting the engine 100 from overspeed, protecting the engine 100 fromuncontrolled high thrust, protecting the propeller from minimum flightbeta, protecting the propeller 120 from overspeed, feathering thepropeller 120 when the output power of the engine 100 is notcontributing to thrust, uptrimming the output power of the engine 100during a take-off phase of flight when a second engine fails (i.e., whenan aircraft comprises the engine 100 and the second engine), featheringthe propeller 120 during a take-off or a go-around phase of flight whenthe second engine of the aircraft fails, and protecting in-flightagainst inadvertent operating of the propeller 120 below a flight finepitch or reverse propeller pitch by limiting the blade angle of thepropeller 120 to a minimum in-flight blade angle. The aforementionedprotection relating to the engine 100 may be performed by the engineprotection module 238 and the aforementioned protecting relating to thepropeller 120 may be performed by the propeller protection module 236.In particular, the engine protection module 238 may be configured todetermine the at least one engine protection signal comprisinginstructions for one or more of: protecting the engine 100 againstoverspeed, and uptrimming the output power of the engine 100 when asecond engine of an aircraft fails. The propeller protection module 236may be configured to determine the at least one propeller protectionsignal comprising instructions for one or more of: protecting thepropeller 120 from overspeed, feathering the propeller 120 when theoutput power of the engine 100 is not contributing to thrust, andprotecting in-flight against operating of the propeller 120 below aflight fine pitch or reverse propeller pitch by limiting the blade angleof the propeller 120 to a minimum in-flight blade angle.

In accordance with an embodiment, the processors (e.g., processors 212,214) in each channel (e.g., channel A) are configured forcross-processor communication. The cross-processor communication mayallow the processors to share information and synchronize their actions(e.g., processing and/or output). In accordance with an embodiment, eachchannel is configured for cross-channel communication. The cross-channelcommunication may allow for the channels to share information andsynchronize their actions (e.g., processing and/or output). Thecross-processor communication and/or the cross-channel communication mayvary depending on practical implementations.

Referring to FIG. 4, the controller 200 is illustrated, where thecontroller 200 is communicatively coupled to at least one first sensor502 and at least one second sensor 504. In this embodiment, the firstsensor 502 is for measuring a first parameter of the engine 100 or thepropeller 120 (i.e., an engine parameter or a propeller parameter) andthe second sensor 504 is for measuring a second parameter of the engine100 or the propeller 120. Each control processor 212, 222 is configuredto receive engine and propeller parameters comprising the firstparameter from the first sensor 502 and the protection processors 214,224 are each configured to receive engine and propeller parameterscomprising the second parameter from the second sensor 504.

In some embodiments, each of the first and second sensor 502, 504 aredual coil sensors comprising a first coil 521 and a second coil 522. Thefirst and second coils 521, 522 of the first sensor 502 are configuredfor measuring the first parameter and the first and second coils 521,522 of the second sensor 504 are configured for measuring the secondparameter. Accordingly, the first coil 521 of the first sensor 502provides a first measurement of the first parameter to the first controlprocessor 212 and the second coil 522 of the first sensor 502 provides asecond measurement of the first parameter to the second controlprocessor 222. The second measurement of the first parameter isindependent from and redundant to the first measurement of the firstparameter. Similarly, the first coil 521 of the second sensor 504provides a first measurement of the second parameter to the firstprotection processor 214 and the second coil 522 of the second sensor504 provides a second measurement of the second parameter to the secondprotection processor 224. The second measurement of the second parameteris independent from and redundant to the first measurement of the secondparameter. The first parameter may be the same as or different from thesecond parameter. In some embodiments, the first and second measurementsof the first and second parameter are independent from and redundant toeach other.

Alternatively, in some embodiments, a given dual coil sensor 502, 504may be replaced with two separate sensors for obtaining independent andredundant measurements of the first parameter and/or the secondparameter. For example, instead of using the two dual coil sensors 502,504, four independent sensors may be used. Accordingly, separate sensorsmay be used to provide the first and second measurements of the firstand second parameters.

In some embodiments, when the first parameter is an engine parameter,the first control processor 212 is configured to generate the at leastone engine control signal based on the first measurement of the firstparameter and the second control processor 222 is configured to generatethe at least one engine control signal based on the second measurementof the first parameter. In some embodiments, when the first parameter isa propeller parameter, the first control processor 212 is configured togenerate the at least one propeller control signal based on the firstmeasurement of the first parameter and the second control processor 222is configured to generate the at least one propeller control signalbased on the second measurement of the first parameter.

In some embodiments, when the second parameter is an engine parameter,the first protection processor 214 is configured to generate the atleast one engine protection signal based on the first measurement of thesecond parameter and the second protection processor 224 is configuredto generate the at least one engine control signal based on the secondmeasurement of the second parameter. In some embodiments, when thesecond parameter is a propeller parameter, the first protectionprocessor 214 is configured to generate the at least one propellerprotection signal based on the first measurement of the second parameterand the second protection processor 224 is configured to generate the atleast one propeller protection signal based on the second measurement ofthe second parameter.

Each processor 212, 214, 222 and 224 has at least one input that isseparate and electrically independent from the inputs of the otherprocessors. A given processor (e.g., the first control processor 212)may receive at least one input signal that is independent from andredundant to the input signals received by at least one of the otherprocessors (e.g., the first protection processor 214, the second controlprocessor 222, and the second protection processor 224). As used herein,the term “independent” in reference to signals refers to signals comingfrom different sources. As used herein, the term “redundant” inreference to a signal refers to a signal that conveys similar orduplicate information as another signal. Each control processor 212, 222may receive an input signal indicative of the first parameter and eachprotection processor 214, 224 may receive an input signal indicative ofthe second parameter.

The second control processor 222 may receive input signals that areindependent from and redundant to the input signals received by thefirst control processor 212. Similarly, the second protection processor224 may receive input signals that are independent from and redundant tothe input signals received by the first protection processor 214. Eachcontrol processor 212, 222 may provide the input signal to the propellercontrol module 232 and the engine control module 234. Similarly, eachprotection processor 214, 224 may provide the input signal to thepropeller protection module 236 and the engine protection module 238.Each processor 212, 214, 222 and 224 may determine the control signalsfor controlling the engine 100 and the propeller 120 and the protectionsignals for protecting the engine 100 and the propeller 120 based on thereceived input signals.

In some embodiments, the first control processor 212 receives at leastone first input signal and the second control processor 222 receives atleast one second input signal. The at least one second input signal isindependent from and redundant to the at least one first input signal.Each signal of the first and second input signals corresponds to thefirst parameter. In some embodiments, the first protection processor 214receives at least one third input signal and the second protectionprocessor 224 receives at least one fourth input signal. The at leastone third input signal is independent and redundant to the at least onefourth input signal. Each signal of the third and fourth input signalscorresponds to the second parameter. In some embodiments, the first,second, third and fourth signals all comprise a common parameter.Alternatively, in some embodiments, the first parameter of the first andsecond signals is different from the second parameter of the third andfourth signals.

In some embodiments, each dual coil sensor 502, 504 is a power turbinespeed and torque (NPT/Q) sensor. The NPT/Q sensor is configured formeasuring both power turbine speed and torque generated at the outputshaft 108 of the engine 100, the output shaft 108 connected to the RGBwhich reduces the shaft speed to a speed that is suitable for thepropeller 120. A first NPT/Q sensor may be coupled (e.g., mounted) tothe gearbox RGB and used to measure power turbine speed and torque ofthe engine 100. The first NPT/Q sensor may provide independent powerturbine speed and torque measurements to the control processors 212, 222of each channel A, B. The controller 200 may determine propellerrotational speed based on the measurement of the power turbine speedknowing the gear ratio in the gearbox RBG. In some embodiments, thisallows for the elimination of a dedicated propeller rotational speed(Np) sensor mounted to the propeller assembly. The control processors212, 222 may determine shaft horse power (SHP) based on the measurementof the torque and then govern the engine power based on the measurementof torque and propeller rotational speed. Similarly, a second NPT/Qsensor may be coupled (e.g., mounted) to the gearbox RGB and used tomeasure power turbine speed and torque of the engine 100. The secondNPT/Q sensor may provide independent power turbine speed and torquemeasurements to the protection processors 214, 224 of each channel A, B.The protection processors 214, 224 may use the power turbine speedmeasurement for engine power turbine overspeed protection. Theprotection processors 214, 224 may use the torque measurement forautofeathering. In accordance with an embodiment, the measurements ofthe power turbine speed and torque provided to the control processors212, 222 are independent from the measurements of the power turbinespeed and torque provided to the protection processor 214, 224. As such,if one of the NPT/Q sensors is faulty, this does not affect both controland protection processors.

In some embodiments, using the controller 200, which has the propellerand engine control and protection in a single electronic device, mayallow for a reduction in the number of sensors required for controland/or protection.

In some embodiments, each dual coil sensor 502, 504 may be replaced withtwo separate sensors, for example, one for measuring power turbine speedand the other for measuring torque.

In some embodiments, each processor 212, 214, 222 and 224 receivesindependent and redundant input signals for both operation and controlpurposes. For example, the first control processor 212 (or the firstprotection processor 214) may receive at least one signal correspondingto an engine operating parameter and/or a propeller operating parameterand at least one other signal corresponding to an engine controlparameter and/or a propeller control parameter. The second controlprocessor 222 (or the second protection processor 224) may receive atleast one signal corresponding to an engine operating parameter and/or apropeller operating parameter and at least one other signalcorresponding to an engine control parameter and/or a propeller controlparameter, where the signals received at the second control processor222 (or the second protection processor 224) are independent from andredundant to the signals received at the first control processor 212 (orthe first protection processor 214). For instance, a dual coil sensor(or two separate sensors) may be used to obtain independent andredundant measurements of a position of the pilot lever 310, whichconveys an engine control parameter and/or a propeller controlparameter.

Referring to FIG. 5, the controller 200 is illustrated, where thecontroller 200 is communicatively coupled to a first control effector602, a second control effector 604, a first protection effector 603 anda second protection effector 605. The control effectors 602, 604configured to control the assembly 10 in a normal mode of operation andthe protection effectors 603, 605 configured to control the assembly toprevent against a hazardous mode of operation. The controller 200 can becommunicatively coupled to each of the effectors 602, 603, 604, 605 byone or more driving circuits. As used herein, the term “effector” refersto any suitable device that is used to change the operation of theengine 100 and/or the propeller 120. A given effector 602, 603, 604, 605may comprise one or more actuators to control the operation of theengine 100 and/or the propeller 120. The terms “effector” and “actuator”may be used interchangeably. In the illustrated embodiment, the firstcontrol processor 212 is connected to the first control effectors 602,the first protection processor 214 is connected to the first protectioneffectors 603, the second control processor 222 is connected to thesecond control effectors and the second protection processor 224 isconnected to the second protection effector 605. In accordance with anembodiment, each of the first control effector 602 and the secondcontrol effector 604 comprises a first actuator 621, 641 configured tocontrol at least one physical component of the engine 100 in order tomodify an operating condition of the engine 100 and a second actuator622, 642 to control at least one physical component of the propeller 120in order to modify an operating condition of the propeller 120.Similarly, in accordance with an embodiment, each of the firstprotection effector 603 and the second protection effector 605 comprisesa first actuator 631, 651 configured to control at least one physicalcomponent of the engine 100 in order to modify the operating conditionof the engine 100 to protect the engine 100 from hazardous conditionsand a second actuator 632, 652 to control at least one physicalcomponent of the propeller 120 to modify the operating condition of thepropeller 120 in order to protect the propeller 120 from hazardousconditions. The protection effectors 603, 605 when activated may beconfigured to override the control effectors 602, 604.

The first control processor 212 may be configured to output at least oneengine control signal and/or at least one propeller control signal tothe first control effector 602. The second control processor 222 may beconfigured to output at least one engine control signal and/or at leastone propeller control signal to the second control effector 604. Thefirst protection processor 214 may be configured to output at least oneengine protection signal and/or at least one propeller protection signalto the first protection effector 603. The second protection processor224 may be configured to output at least one engine protection signaland/or at least one propeller protection signal to the second protectioneffector 605.

Each processor 212, 214, 222 and 224 has at least one separateelectrically independent output for outputting at least one independentsignal. In some embodiments, both channels A and B are active and bothare generating and outputting control and/or protection signals, therebyproviding independent and redundant control and/or protection signals.Each control processor 212, 222 may generate and output one or moreindependent control signals for controlling a same operating conditionof the engine 100 and/or a same operating condition of the propeller120. Similarly, each protection processor 214, 224 may output one ormore independent protection signals for protecting the engine 100 and/orthe propeller 120. For instance, the second control processor 222 maygenerate control signals that are independent from and redundant to thecontrol signals generated by the first control processor 212. Similarly,the second protection processor 224 may generate protection signals thatare independent and redundant to the protection signals generated by thefirst protection processor 214. In some embodiments, independent andredundant input signals at the second control processor 222 (or thesecond protection processor 224) are used to generate control signals(or protection signals) that are independent and redundant from thecontrol signals (or protection signals) of the first control processor212 (or the first protection processor 214).

In some embodiments, each propeller control module 232 and each enginecontrol module 234 outputs independent control signals. Similarly, insome embodiments, each propeller protection module 236 and each engineprotection module 238 outputs independent protection signals.

In the embodiment illustrated in FIG. 5, dual actuator effectors 602,603, 604, 605 are illustrated. Alternatively, in some embodiments, agiven dual actuator effector 602, 603, 604, 605 may be replaced with twoseparate actuators. For example, each dual actuator effector 602, 603,604, 605 could be replaced with a first actuator configured andconnected to the controller 200 in a similar manner as the firstactuator 621, 631, 641, 651 and a second actuator configured andconnected to the controller 200 in a similar manner as the secondactuator 622, 632, 642, 652. In some embodiments, two effectors (e.g.,the control effectors 602, 604, or the protection effectors 603, 605)may be replaced with a dual channel effector, where each channel of thedual channel effector is connected to one of channels A, B of thecontroller 200. In other words, one of the channels of the dual channeleffector may be configured and connected to the controller 200 and theother channel of the dual channel effector may be configured andconnected to the controller 200. In some embodiments, both channels A, Bof the controller 200 may use the same effector and thus only onecontrol effector and one protection effector may be used. For example,both control processors 212, 222 could be connected to a commondual-channel control effector and both protection processor 214, 224could be connected to a common dual-channel protection effector. Morespecifically, in some embodiments, each dual-channel effector maycomprise a first and a second actuator. The control processors 212, 222may then be connected to the first actuator and the second actuator ofthe dual-channel control effector and the protection processors 214, 224may be connected to the first actuator and the second actuator of thedual-channel protection effector. In some embodiments, single actuatoreffectors 602, 603, 604, 605 may be used.

In some embodiments, the first actuator 621 of the first controleffector 602 is configured to receive the at least one engine controlsignal from the first control processor 212 and the second actuator 622of the first control effector 602 is configured to receive the at leastone propeller control signal from the first control processor 212. Insome embodiments, the first actuator 641 of the second control effector604 is configured to receive the at least one engine control signal fromthe second control processor 222 and the second actuator 642 of thesecond control effector 604 is configured to receive the at least onepropeller control signal from the second control processor 222. In someembodiments, the first actuator 631 of the first protection effector 603is configured to receive the at least one engine protection signal fromthe first protection processor 214 and the second actuator 632 of thefirst protection effector 603 is configured to receive the at least onepropeller protection signal from the first protection processor 214. Insome embodiments, the first actuator 651 of the second protectioneffector 605 is configured to receive the at least one propellerprotection signal from the second protection processor 224 and thesecond actuator 652 of the second protection effector 605 is configuredto receive the at least one propeller protection signal from the secondprotection processor 224.

In some embodiments, the first actuator 621 of the first controleffector 602 is connected to the engine control module 234 of the firstcontrol processor 212 and the second actuator 622 of the first controleffector 602 is connected to the propeller control module 232 of thefirst control processor 212. In some embodiments, the first actuator 641of the second control effector 604 is connected to the engine controlmodule 234 of the second control processor 222 and the second actuator642 of the second control effector 604 is connected to the propellercontrol module 232 of the second control processor 222. In someembodiments, the first actuator 631 of the first protection effector 603is connected to the engine protection module 238 of the first protectionprocessor 214 and the second actuator 632 of the first protectioneffector 603 is connected to the propeller protection module 236 of thefirst protection processor 214. In some embodiments, the first actuator651 of the second protection effector 605 is connected to the engineprotection module 238 of the second protection processor 224 and thesecond actuator 652 of the second protection effector 605 is connectedto the propeller protection module 236 of the second protectionprocessor 224. The control and protection modules 232, 234, 236, 238 canprovide various control signals to the effectors 602, 603, 604, 605.

In some embodiments, the first and second control effectors 602, 604comprise a torque motor or a stepper motor for controlling a fuel valveof the engine 100 to control the amount of fuel provided to the engine100. In some embodiments, the first and second protection effectorscomprise a fuel cut-off solenoid for stopping fuel flow to the engine100. For example, a given control processor 212, 222 can accordinglycontrol the fuel flow to the engine 100 and a given protection processor214, 224 can cut-off the fuel flow to the engine 100 in the event that acommanded fuel flow from the given control processor 212, 222 is toohigh (e.g., above a threshold). In some embodiments, the first andsecond control effectors 602, 604 comprise a control valve forcontrolling the blade angle of the propeller 120. In some embodiments,the first and second protection effectors comprise a feather solenoidfor overriding the control valve and for feathering the propeller 120.For example, a given control processor 212, 222 can accordingly controlthe blade angle of the propeller 120 to hold the propeller blade speedsubstantially constant and a given protection processor 214, 224 canfeather the propeller blades in the event that the propeller blade speedis too high (e.g., above a threshold).

In some embodiments, one of the channels (e.g., channel A) is selectedas being active, while the other channel remains inactive (e.g., channelB). When a channel is active, that channel is configured to generate andoutput control signals and, when a channel is inactive, that channeldoes not generate and output any control signal. If it is determinedthat the presently active channel or the output effector connected tothe channel is faulty or inoperative, the presently active channel maybe inactivated and one of the inactive channels is activated. Similarly,if, during operation, an input signal to a presently active channel iserroneous or inexistent, the presently active channel may be inactivatedand one of the inactive channels is activated.

In some embodiments, the configuration of the controller 200 and/or thecontrol system 300 allows for duplexing of the control channels, whichmay eliminate the requirement for a hydro-mechanical control back-upsystem while retaining the reliability by duplexing the electronicsensors and effectors as well as the dual process configuration for bothcontrol and protection functions.

It should be appreciated that the controller 200 may be used on a singleor multi-engine aircraft.

With reference to FIG. 6, there is shown a flowchart illustrating anexample method 400 for engine and propeller control. While the method400 is described herein with reference to the engine 100 and thepropeller 120 of FIG. 1, this is for example purposes. The method 400may be applied to other types of engines and propellers depending onpractical implementations. At step 402, a first set of engine andpropeller parameters are received at a first control processor(reference 212 of FIG. 2) of a first channel (channel A in FIG. 2) andat a second control processor (reference 222 in FIG. 2) of a secondchannel (reference B in FIG. 2). At step 404, a second set of engine andpropeller parameters are received at a first protection processor(reference 214 of FIG. 2) of the first channel A and at a secondprotection processor (reference 224 of FIG. 2) of the second channel B.The first set of engine and propeller parameters may be the same as ormay be different from the second set of engine and propeller parameters.The first set of engine and propeller parameters received at the firstcontrol processor 212 may be independent and redundant to the first setof engine and propeller parameters received at the second controlprocessor 222. The term “independent” in reference to engine and/orpropeller parameters refers to engine and/or propeller parameters comingfrom different sources. The term “redundant” in reference to engineand/or propeller parameters refers to engine and/or propeller parametersthat convey similar or duplicate information as other engine and/orpropeller parameters. The first and second sets of engine and propellerparameters may comprise any of the parameters described herein and thereceiving of the engine and propeller parameters may be as describedelsewhere in this document.

At step 406, at least one of the control processors 212, 222, generates,based on the first set of engine and propeller parameters, at least oneengine control signal comprising instructions for controlling anoperation of the engine 100 and at least one propeller control signalcomprising instructions for controlling an operation of the propeller120. At step 408, at least one of the protection processor 214, 224,generates, based on the second set of engine and propeller parameters,at least one engine protection signal comprising instructions forprotecting the engine 100 from hazardous condition(s) and at least onepropeller protection signal comprising instructions for protecting thepropeller 120 from hazardous condition(s). The at least one enginecontrol signal, the at least one propeller control signal, the at leastone engine protection signal and the at least one propeller protectionsignal may be generated as described elsewhere in this document.

At step 410, at least one of the control processor 212, 222, outputs theat least one engine control signal and the at least one propellercontrol signal. At step 412, at least one of the protection processor214, 224, outputs the at least one engine protection signal and the atleast one propeller protection signal. The outputting of the control andprotection signals may be as described elsewhere in this document.

It should be understood that, while steps 402 and 404 are illustrated asbeing performed in series in FIG. 6, steps 402 and 404 may alternativelybe performed in parallel. Similarly, steps 406 and 408, and steps 410and 412 may also be performed in parallel, although illustrated in FIG.6 as being performed in series. As such, the method 400 may compriseperforming steps 402, 406, and 410 in parallel with performing steps404, 408, and 412.

In some embodiments, one of the control processors 212, 222 is activeand the other one is passive. In other words, one of the controlprocessors 212, 222 is performing the steps of the method 400.Alternatively, in some embodiments, both of the control processors 212,222 are active and are performing the steps of the method 400.Similarly, in some embodiments, one of the protection processors 214,224 is active and the other one is passive such that one of theprotection processors 214, 224 is performing the steps of the method400. Alternatively, in some embodiments, both of the protectionprocessors 214, 224 are active and are performing the steps of themethod 400. In a specific and non-limiting example of implementation,one of the control processors 212, 222 is active and both of theprotections processors are active 214, 224.

With reference to FIG. 7, each of the processors 212, 214, 222 and 224of the controller 200 may comprise a processing unit 712 and a memory714 which has stored therein computer-executable instructions 716. Themethod 400 may be implemented by the processors 212, 214, 222 and 224.The processing unit 712 may comprise any suitable devices such thatinstructions 716, when executed by a processor 212, 214, 222 or 224, orother programmable apparatus, may cause the functions/acts/steps asdescribed herein to be executed. The processing unit 712 may comprise,for example, any type of general-purpose microprocessor ormicrocontroller, a digital signal processing (DSP) processor, a centralprocessing unit (CPU), an integrated circuit, a field programmable gatearray (FPGA), a reconfigurable processor, other suitably programmed orprogrammable logic circuits, or any combination thereof.

The memory 714 may comprise any suitable known or other machine-readablestorage medium. The memory 714 may comprise non-transitory computerreadable storage medium, for example, but not limited to, an electronic,magnetic, optical, electromagnetic, infrared, or semiconductor system,apparatus, or device, or any suitable combination of the foregoing. Thememory 714 may include a suitable combination of any type of computermemory that is located either internally or externally to device, forexample random-access memory (RAM), read-only memory (ROM), compact discread-only memory (CDROM), electro-optical memory, magneto-opticalmemory, erasable programmable read-only memory (EPROM), andelectrically-erasable programmable read-only memory (EEPROM),Ferroelectric RAM (FRAM) or the like. Memory 714 may comprise anystorage means (e.g., devices) suitable for retrievably storingmachine-readable instructions 716 executable by processing unit 712.

In some embodiments, the controller 200 can be implemented as part of afull-authority digital engine controls (FADEC) or other similar device,including electronic engine control (EEC), engine control unit (ECU),and the like.

The method 400 and the functionality of the controller 200 and theprocessors 212, 214, 222 and 224 described herein may be implemented ina high level procedural or object oriented programming or scriptinglanguage, or a combination thereof, to communicate with or assist in theoperation of a control system, for example the control system 300.Alternatively, the method 400 and the functionality of the controller200 and the processors 212, 214, 222 and 224 may be implemented inassembly or machine language. The language may be a compiled orinterpreted language. Program code for implementing the method 400 andthe functionality of the controller 200 and the processors 212, 214, 222and 224 may be stored on a storage media or a device, for example a ROM,a magnetic disk, an optical disc, a flash drive, or any other suitablestorage media or device. The program code may be readable by a generalor special-purpose programmable computer for configuring and operatingthe computer when the storage media or device is read by the computer toperform the procedures described herein. Embodiments of the method 400,the controller 200, control system 300 and/or processors 212, 214, 222and 224 may also be considered to be implemented by way of anon-transitory computer-readable storage medium having a computerprogram stored thereon. The computer program may comprisecomputer-readable instructions which cause a computer, or in someembodiments the processing unit 712, to operate in a specific andpredefined manner to perform the functions described herein.

Computer-executable instructions may be in many forms, including programmodules, executed by one or more computers or other devices. Generally,program modules include routines, programs, objects, components, datastructures, etc., that perform particular tasks or implement particularabstract data types. Typically the functionality of the program modulesmay be combined or distributed as desired in various embodiments.

The above description is meant to be exemplary only, and one skilled inthe art will recognize that changes may be made to the embodimentsdescribed without departing from the scope of the invention disclosed.Still other modifications which fall within the scope of the presentinvention will be apparent to those skilled in the art, in light of areview of this disclosure.

Various aspects of the method, the controller and/or the control systemmay be used alone, in combination, or in a variety of arrangements notspecifically discussed in the embodiments described in the foregoing andis therefore not limited in its application to the details andarrangement of components set forth in the foregoing description orillustrated in the drawings. For example, aspects described in oneembodiment may be combined in any manner with aspects described in otherembodiments. Although particular embodiments have been shown anddescribed, it will be obvious to those skilled in the art that changesand modifications may be made without departing from this invention inits broader aspects. The scope of the following claims should not belimited by the embodiments set forth in the examples, but should begiven the broadest reasonable interpretation consistent with thedescription as a whole.

What is claimed is:
 1. An electronic controller for an engine and apropeller coupled to the engine, the controller comprising: a firstcommunication channel and a second communication channel independentfrom and redundant to the first communication channel, eachcommunication channel having a control processor and a protectionprocessor communicating thereover, the control processor controlling theengine and the propeller in a normal mode of operation thereof and theprotection processor controlling the engine and the propeller to preventagainst a hazardous mode of operation thereof, the control processorconfigured to receive a first set of engine and propeller parameters andto output, based on the first set of engine and propeller parameters, atleast one engine control command and at least one propeller controlcommand, the at least one engine control command comprising instructionsfor controlling the engine in the normal mode of operation and the atleast one propeller control command comprising instructions forcontrolling the propeller in the normal mode of operation, and theprotection processor configured to receive a second set of engine andpropeller parameters and to output, based on the second set of engineand propeller parameters, at least one engine protection command and atleast one propeller protection command, the at least one engineprotection command comprising instructions overriding the at least oneengine control command to prevent hazardous operation of the engine andthe at least one propeller protection command comprising instructionsoverriding the at least one propeller control command to preventhazardous operation of the propeller.
 2. The electronic controller ofclaim 1, wherein the control processor comprises an engine controlmodule configured for generating the at least one engine control commandbased on at least one engine parameter of the first set of engine andpropeller parameters, and a propeller control module configured forgenerating the at least one propeller control command based on at leastone propeller parameter of the first set of engine and propellerparameters.
 3. The electronic controller of claim 2, wherein the enginecontrol module is configured to generate the at least one engine controlcommand comprising instructions for one or more of: governing arotational speed of the engine, governing an output power of the engine,limiting a torque of the engine, and limiting a rotational speed of theengine.
 4. The electronic controller of claim 2, wherein the propellercontrol module is configured to generate the at least one propellercontrol command comprising instructions for one or more of: governing abeta angle of the propeller and governing a rotational speed of thepropeller.
 5. The electronic controller of claim 2, wherein theprotection processor comprises an engine protection module configuredfor generating the at least one engine protection command based on atleast one engine parameter of the second set of engine and propellerparameters, and a propeller protection module configured for generatingthe at least one propeller protection command based on at least onepropeller parameter of the second set of engine and propellerparameters.
 6. The electronic controller of claim 5, wherein the engineprotection module is configured to generate the at least one engineprotection command comprising instructions for one or more of:protecting the engine from overspeed and protecting the engine fromuncontrolled high thrust.
 7. The electronic controller of claim 5,wherein the propeller protection module is configured to generate the atleast one propeller protection command comprising instructions for oneor more of: protecting the propeller from overspeed, feathering thepropeller when an output power of the engine is not contributing tothrust, and protecting the propeller from minimum flight beta.
 8. Theelectronic controller of claim 1, wherein the first set of engine andpropeller parameters and the second set of engine and propellerparameters are the same.
 9. The electronic controller of claim 1,wherein the second set of engine and propeller parameters receivable bythe control processor of the second communication channel areindependent to and redundant from the first set of engine and propellerparameters receivable by the control processor of the firstcommunication channel.
 10. The electronic controller of claim 9, whereinthe second set of engine and propeller parameters receivable by theprotection processor of the second communication channel are independentto and redundant from the second set of engine and propeller parametersreceivable by the protection processor of the first communicationchannel.
 11. A method for controlling an engine and a propeller coupledto the engine, the method comprising: receiving a first set of engineand propeller parameters at a first control processor provided in afirst communication channel and at a second control processor providedin a second communication channel independent from and redundant to thefirst communication channel; receiving a second set of engine andpropeller parameters at a first protection processor provided in thefirst communication channel and at a second protection processorprovided in the second communication channel; generating, by at leastone of the first control processor and the second control processor andbased on the first engine and propeller parameters, at least one enginecontrol command and at least one propeller control command, the at leastone engine control command comprising instructions for controlling theengine in the normal mode of operation and the at least one propellercontrol command comprising instructions for controlling the propeller inthe normal mode of operation; generating, by at least one of the firstprotection processor and the second protection processor and based onthe second engine and propeller parameters, at least one engineprotection command and at least one propeller protection command, the atleast one engine protection command comprising instructions foroverriding the at least one engine control command to prevent hazardousoperation of the engine and the at least one propeller protectioncommand comprising instructions for overriding the at least onepropeller control command to prevent hazardous operation of thepropeller; outputting, by at least one of the first control processorand the second control processor, the at least one engine controlcommand and the at least one propeller control command; and outputting,by at least one of the first protection processor and the secondprotection processor, the at least one engine protection command and theat least one propeller protection command.
 12. The method of claim 11,wherein generating the at least one engine control command comprisesgenerating the at least one engine control command based on at least oneengine parameter of the first set of engine and propeller parameters;and wherein generating the at least one propeller control commandcomprises generating the at least one propeller control command based onat least one propeller parameter of the first set of engine andpropeller parameters.
 13. The method of claim 12, wherein generating theat least one engine control command comprises generating instructionsfor one or more of governing a rotational speed of the engine, governingan output power of the engine, limiting a torque of the engine andlimiting a rotational speed of the engine.
 14. The method of claim 12,wherein generating the at least one propeller control signal comprisesgenerating instructions for one or more of: governing a beta angle ofthe propeller and governing a rotational speed of the propeller.
 15. Themethod of claim 12, wherein generating the at least one engineprotection command comprises generating the at least one engineprotection command based on at least one engine parameter of the secondset of engine and propeller parameters; and wherein generating the atleast one propeller protection command comprises generating the at leastone propeller control command based on at least one propeller parameterof the second set of engine and propeller parameters.
 16. The method ofclaim 15, wherein generating the at least one engine protection commandcomprises generating instructions for protecting the engine fromoverspeed.
 17. The method of claim 15, wherein generating the at leastone propeller protection command comprises generating instructions forone or more of: protecting the propeller from overspeed and featheringthe propeller when an output power of the engine is not contributing tothrust.
 18. The method of claim 11, wherein the first set of engine andpropeller parameters and the second set of engine and propellerparameters are the same.
 19. The method of claim 11, wherein the secondset of engine and propeller parameters received by the second controlprocessor are independent to and redundant from the first set of engineand propeller parameters received by the first control processor. 20.The method of claim 11, wherein the second set of engine and propellerparameters received by the second protection processor are independentto and redundant from the second set of engine and propeller parametersreceived by the first protection processor.